SAFETY SWITCHING APPARATUS 



FOR SAFELY DISCONNECTING AN ELECTRICAL LOAD 

CROSS-REFERENCES TO RELATED APPLICATIONS 

[0001] This application is a continuation of copending interna- 
tional patent application PCT/EP02 / 0943 3 filed on August 23, 
2002 designating the U.S., which international patent applica- 
tion is published in German language and claims priority from 
German patent application DE 101 46 753.2, filed on September 
22, 2001. 

BACKGROUND OF THE INVENTION 

[0002] The present invention relates to safety switching appa- 
ratuses for safely disconnecting an electrical load, and in 
particular to apparatuses for safely disconnecting an electri- 
cal machine. Even more specifically, the present invention 
relates to such a safety switching apparatus comprising at 
least one output switch for interrupting an external power 
supply path, the output switch having at least two switching 
positions, and comprising a control unit which controls and 
monitors the switching position of the output switch. 

[0003] Prior art safety switching apparatuses are especially 
used in industry for at least partially disconnecting electri- 
cally driven machines, such as large brake presses, CNC- 
controlled machining centers or robots, in a reliable manner. A 
typical application is the disconnection of a machine when a 
guard door is opened, a light barrier is interrupted or an 
emergency off switch is actuated. The signals from these signal 



transmitters are fed to the prior art safety switching appara- 
tuses which disconnect the corresponding machine or machine 
parts in response thereto. In this case, the actual disconnec- 
tion process, i.e. the interruption of a power supply to the 
machine, must take place in an extremely reliable manner, since 
otherwise the health or even the life of the operator is put at 
risk. Prior art safety switching devices are therefore approved 
for operation by relevant regulatory authorities, such as pro- 
fessional associations (BG) in Germany, only if they meet the 
specific minimum requirements for their intrinsic failsafety. 
In general, a safety switching apparatus must allow to discon- 
nect the machine in a reliable and . failsafe manner even when 
faults or disruptions occur within the safety switching appara- 
tus or the signal transmitters associated with it. 

[0004] Therefore, only devices and systems that meet at least 
Category 3 of European Standard EN 954-1 or a corresponding 
safety standard are considered as safety switching apparatuses 
within the meaning of the present invention. 

[0005] With prior art safety switching apparatuses, the switch- 
ing position of the output switch, with which the power supply 
to the machine can be interrupted, must always be monitored in 
a reliable and failsafe manner. The reason for this is the fact 
that, otherwise, a fault or a disruption in the operation of 
the output switch may lead to the monitored machine being in a 
dangerous, unsafe state. For long and up to now, electrome- 
chanical switching elements, i.e. relays or contactors, have 
often been used for the output switches in prior art safety 
switching apparatuses . Such switching elements are known to be 
subject to the risk of the switching contacts welding together 



owing to sparking when the switch is opened. In this case, the 
output switch can no longer be opened, which may have devastate 
ing consequences. 

[0006] Only in recent times have semiconductor components also 
been used as output switches in prior art safety switching 
apparatuses. Although mechanical contacts cannot weld together 
with these semiconductor components, there is basically the 
possibility of the switching path through the component break- 
ing down and thus likewise of a short circuit forming which can 
no longer be opened. 

[0007] WO 01/37302 Al discloses a prior art safety switching 
apparatus which has two relays as output switches on the output 
side. The make contacts of the two relays are connected in 
series in a manner known per se in order to achieve redundancy 
and thus increased reliability on disconnection. Each of the 
two relays has two or more make contacts such that, for exam- 
ple, all three phases of a three-phase connection can be dis- 
connected. In addition, each of the two relays has an auxiliary 
contact which is positively (forcibly) driven by the make con- 
tacts through a mechanical link. This mechanically positively 
driven operation ensures that the switching position of the 
make contacts corresponds to the switching position of the 
auxiliary contact. The switching position of the make contacts 
can thus be monitored by means of the auxiliary contact. 

[0008] The described arrangement is widely used in practice and 
has proved very successful. One disadvantage, however, is that 
relays with positively driven contacts are considerably more 
expensive than basic relays. In addition, positively driven 
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relays are larger and have lower holding forces than basic 
relays. 

SUMMARY OF THE INVENTION 

[0009] In view of the above, it is an object of the present 
invention to provide an alternative which allows to avoid posi- 
tively driven relays in a safety switching apparatus. 

[0010] It is a further object to provide a less expensive 
safety switching apparatus still fulfilling all the safety 
requirements with respect to failsafety and reliability. 

[0011] It is yet another object to provide a safety switching 
apparatus which is smaller in terms of space requirements. 

[0012] According to one aspect of the invention, these and 
other objects are achieved by a safety switching apparatus of 
the type mentioned initially further having a radio-frequency 
(RF) generator for generating an RF test signal, and a coupling 
circuit which is used to transmit the RF test signal to the 
output switch thereby allowing to monitor the switching posi- 
tions . 

[0013] With the new safety switching apparatus, the switching 
position of the output switch is monitored by means of an RF 
test signal which is fed to the output switch in addition to 
the load current which is actually to be connected. Since the 
frequencies of the load currents to be connected are generally 
very low (in the range from 16 2/3 to 400 Hz), a ra- 
dio-frequency signal is highly suitable since it is technically 
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very easy to isolate it from the load current again using fil- 
tering measures known per se. The frequency of the test signal 
preferably lies in the range from 2 MHz to 100 MHz . On the 
other hand, the test signal used here is an electrical signal, 
which means that the electrically effective switching position 
of the output switch can be monitored particularly well. 

[0014] The safety switching apparatus according to the inven- 
tion has the advantage that use of positively driven relays or 
contactors can be dispensed with, which means that the produc- 
tion costs can be reduced. In addition, the safety switching 
apparatus according to the invention may be more compact and 
have a lower space requirement. 

[0015] A further advantage is the fact that the switching 
position of semiconductor components may also be monitored in a 
reliable manner with the approach according to the — i-n ve nt-ion— 
The basic concept for the device may thus also^ be used for 
future generations of safety switching apparatuses. 

[0016] In a refinement of the invention, the coupling circuit 
has at least one isolating element which provides DC isolation 
between the RF generator and the at least one output switch. 

[0017] This allows to implement the output circuit of the 
safety switching apparatus in a floating manner (without a 
fixed ground potential), which increases both the safety and 
the range of applications of the apparatus according to the 
invention. In addition, the monitoring circuit, which generally 
operates only at low voltages and currents , is now protected 
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against the generally higher load currents supplied to the 
monitored machine. 

[0018] In a further refinement , the isolating element has at 
least one coupling capacitor. 

[0019] This measure prevents a DC short circuit in the output 
switch, which further increases the safety of the apparatus 
overall. 

[0020] In a further refinement, the coupling capacitor has a 
printed circuit board capacitance. 

[0021] This measure makes it possible to reduce the number of 
discrete components required, which enables cost-effective 
production. In addition, the apparatus according to the inven- 
tion may be even smaller, i.e. have an even lower space re- 
quirement. 

[0022] In a further refinement of the previously mentioned 
approach, the printed circuit board capacitance has conductor 
surfaces which are arranged on different layers of an at least 
two-layer printed circuit board. 

[0023] This measure has considerable advantages, in particular 
in relation to the intended field of application for the safety 
switching apparatus, since disruption during operation as a 
result of a faulty coupling capacitor can be reliably ruled out 
with the described arrangement. For fault analysis, the rele- 
vant standards allow faults to be ruled out which are based on 
a short circuit between different layers of a conventional 
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printed circuit board. The safety switching apparatus may 
therefore be simpler overall , and thus less expensive. 

[0024] In a further refinement, the coupling circuit has at 
least two coupling capacitors . 

[0025] This measure further increases the intrinsic failsafety 
of the apparatus according to the invention. In particular , a 
DC short circuit in the output switch is thus ruled out even 
more reliably. In addition, symmetry results which makes it 
possible to monitor the switching position of the output switch 
in a particularly simple and, at the same time, accurate man- 
ner. 

[0026] In a further refinement of the invention, the coupling 
circuit has an electrical resonant circuit. 

[0027] Owing to the sensitivity, known per se, of a resonant 
circuit to changes in the influencing parameters, this measure 
makes it possible to monitor the output switch in a simple and 
particularly precise manner. 

[0028] In a further refinement of the measure mentioned previ- 
ously, the output switch is embedded in the resonant circuit. 

[0029] This measure is a particularly simple way of precisely 
monitoring the switching position of the output switch. In 
addition, this arrangement saves on modules, making it possible 
to further reduce the production costs of the apparatus accord- 
ing to the invention. 
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[0030] In a further refinement, the resonant circuit interacts 
with at least one ohmic resistor whose voltage drop is a meas- 
ure of the actual switching position of the output switch, 

[0031] The current flowing into the resonant circuit is pref- 
erably fed via said ohmic resistor. This measure makes it pos- 
sible to use a simple threshold value switch to determine the 
switching position of the output switch. It is in this case 
possible to tap off a voltage drop across the ohmic resistor 
using means known per se in a very simple and inexpensive man- 
ner .. Overall , the production costs of the apparatus according 
to the invention can thus be reduced even further. 

[0032] In a further refinement, the output switch is connected 
to at least one connection terminal, with a radio-frequency 
(RF) filter being arranged between the output switch and the 
connection terminal. 

[0033] On the one hand, this measure prevents the RF test 
signal from being able to pass to the outside from the inside 
of the safety switching device, thus preventing the machine to 
be disconnected from being influenced by it. On the other hand, 
the RF test signal is decoupled in this manner from external 
influences, which increases reliability and measurement accu- 
racy when monitoring the switching position of the output 
switch. 

[0034] It goes without saying that the abovementioned features 
and those yet to be mentioned can be used not only in the com- 
bination given in each case but also in other combinations or 



on their own without departing from the scope of the present 
invention. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0035] Exemplary embodiments of the invention are illustrated 
in the drawing and are explained in more detail in the follow- 
ing description. In the drawing: 

shows a basic circuit diagram of an arrangement for use 
in a safety switching apparatus according to the inven- 
tion, 

shows a preferred embodiment of coupling capacitors 
which are also used in the basic circuit diagram shown 
in Fig. 1, and 

shows a detailed illustration of a safety switching 
apparatus according to the invention. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

[0036] In Fig. 1, an arrangement for failsafe monitoring of the 
switching position of an output switch has the reference nu- 
meral 10 in its entirety. 

[0037] The arrangement 10 has a control unit 12 which controls 
the switching position of an output switch 14 in a manner known 
per se. The output switch 14 is illustrated in the present case 
as a relay contact. However, the principle of the arrangement 



Fig. 1 



Fig. 2 



Fig. 3 
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10 can also be applied in the same manner to semiconductor 
switches, such as MOS transistors. 

[0038] The reference numeral 16 is given to an RF generator 
which is connected to the output switch 14 via a DC isolating 
element 18 such that an RF test signal (RF voltage and/or RF 
current), not illustrated here, is fed through the output 
switch 14. 

[0039] According to a preferred embodiment of the invention, 
the isolating element 18 has two coupling capacitors 20, 22 
which in all cases prevent a DC short circuit in the output 
switch 14 . 

[0040] The RF generator 16 has a sensor element (not illus- 
trated separately here) which detects a change in the RF test 
signal as a function of the switching position of the output 
switch 14. For example, the resonant frequency of the RF gen- 
erator 16, the RF current flowing through the coupling capaci- 
tors 20, 2 2 or the power produced in the RF generator change as 
a function of the switching position of the output switch 14. 
The detected change is communicated to the control unit 12 via 
a feedback line 24. As a result, the control unit 12 can con- 
stantly compare the actual switching position of the output 
switch 14 with the selected nominal switching position and can 
thus monitor the output switch 14. The control unit 12 can 
check, in the manner of a self -test, that all of the modules 
are operating properly by the output switch 14 being switched 
over and a check being made to determine whether the reaction 
on the line 24 corresponds to the expected value. 
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[0041] For the purpose of illustrating the principle of the 
arrangement 10, reference numeral 26 schematically represents a 
load which , in a specific application , is a machine to be dis- 
connected, for example. The machine 2 6 is supplied with power 
via power supply 28, the output switch 14 being arranged in the 
power supply path 30. In this case, the power supply 28 may 
also be an AC voltage source instead of the DC voltage source 
illustrated. 

[0042] Fig. 2 shows a preferred embodiment of the two coupling 
capacitors 20, 22, with identical reference numerals being used 
for the same elements as in Fig. 1. 

[0043] The circuit components of the arrangement 10 are ar- 
ranged on a printed circuit board 4 0 in a manner known per se. 
In this case , the circuit components , such as the RF generator 
16 and the control unit 12 (illustrated as an IC in this case), 
are connected to one another via conductor tracks 42. The two 
coupling capacitors 20, 22 are formed by conductor surfaces 44, 
4 6 which are arranged here on different layers of the two-layer 
printed circuit board 40. The plastic material of the printed 
circuit board 40 is thus between the metallic conductor sur- 
faces 44, 46, and a capacitance is thus formed in a manner 
which is readily apparent to those skilled in the art. When 
analyzing sources of faults within the arrangement 10, the 
described arrangement rules out the possibility of one or both 
coupling capacitors 20, 22 being subjected to an electrical 
short circuit. This fault is ruled out on the basis of exist- 
ing, relevant standards. 
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[0044] In Fig. 3, an exemplary embodiment of a safety switching 
apparatus according to the invention has is designated by ref- 
erence numeral 50 in its entirety. In this case it is a so- 
called safety switching device which is generally distributed 
as a compact and fully operational unit. The invention is not, 
however, limited only to safety switching devices and may also 
be used for more complex, programmable safety controllers. 

[0045] The safety switching device 50 is incorporated as a 
compact unit in a device housing 52 in a manner known per se. 
Connection terminals (three of which, by way of example, have 
the reference numerals 54, 56, 58 here) are provided on an 
outer face of the housing 52 in a manner known per se. Connec- 
tion terminal 54 is connected to one phase of the power supply 
28. Connection terminal 5 6 is connected to the machine 26 to be 
disconnected. The power supply path 30 in which the output 
switch 14 is arranged in series is thus provided between the 
connection terminals 54 and 56. 

[0046] The illustration of the safety switching device 50 is 
simplified here for reasons of clarity. In practice there are 
generally two output switches 14 connected in series with one 
another in the power supply path 30, in order to achieve redun- 
dancy when the machine 26 is disconnected. Furthermore, the 
safety switching device 50 according to the invention generally 
has further output switches, which are arranged in parallel 
with the output switch 14, and corresponding connection termi- 
nals 54, 56, by means of which further phases of the power 
supply 2 8 can be connected. Such refinements are known per se 
and are therefore not described here in any more detail. 
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[0047] An emergency off switch 6 0 is connected to the connec- 
tion terminal 58 in a manner known pier se. This is also shown 
here in Fig. 3 in a simplified form, since emergency off 
switches are generally subject to multichannel evaluation by 
the safety switching devices described here. 

[0048] Internally, the safety switching device 50 has the 
following design: 

[0049] The control unit 12 has a switch 62 which connects or 
disconnects the current in a manner known per se by means of a 
relay 64. The output switch 14 is one of the make contacts of 
the relay 64 so that the control unit 12 can control the 
switching position of the output switch 14 by means of the 
switch 62. However, in alternative exemplary embodiments, semi- 
conductor components may also be used instead of a relay 64 as 
the output switch . 

[0050] The output switch 14 is connected to an RF generator 16 
in a manner which has already been described with reference to 
Fig. 1. In addition to the two coupling capacitors 20, 22, the 
isolating element in this case has a transformer 66, whose 
inductance, together with the coupling capacitors 20, 22, forms 
a resonant circuit 68. The RF generator, which in the present 
exemplary embodiment is an 8 MHz commercially available RF 
oscillator, generates the RF test signal which has the refer- 
ence numeral 70 in this figure. The RF generator 16 is supplied 
with an operating voltage via a resistor 72. In order to stabi- 
lize and smooth the operating voltage, a capacitor 74 is ar- 
ranged in parallel with the RF generator 16. 
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[0051] Arranged in parallel with the resistor 72 is a threshold 
value switch 76 which compares the voltage drop across the 
resistor 72 with a reference value. The output signal of the 
threshold value switch 76 is fed to the control unit 12 via the 
feedback line 24. 

[0052] A further capacitor which, together with a coil 80, 
forms an LC filter 82 has the reference numeral 78. The LC 
filter 82 is arranged between the output switch 14 and the 
connection terminal 54. An identical second LC filter 84 is 
also arranged between the output switch 14 and the connection 
terminal 56. The two LC filters 82, 84 form a clamp which may 
also surround further, redundant switching contacts arranged in 
series with the output switch 14. 

[0053] The safety switching device 50 operates as follows: 

[0054] When the safety switching device 50 is in operation, the 
output switch 14 - is closed so that the machine 2 6 is connected 
to the power supply 28. The machine 26 is therefore in opera- 
tion. 

[0055] The open output switch 14 represents a capacitance of 
the order of magnitude of approximately 1 pF . When the output 
switch 14 is open, this capacitance essentially determines the 
resonant frequency of the resonant circuit 68, since the ca- 
pacitances of the coupling capacitors 20, 22 are approximately 
100 pF. The resonant frequency of the resonant circuit 68 cor- 
responds in this switching position to the desired frequency of 
the RF generator 16. 



15 



[0056] If the output switch 14 is closed, its effective capaci- 
tance changes, thus mistuning the resonant circuit 68. 

[0057] In return, this has an effect on the RF generator 16 via 
the transformer 66, and this further results in the voltage 
drop across the resistor 72 changing. The changed voltage drop 
is detected by means of the threshold value switch 76 and is 
communicated to the control unit 12. This allows the control 
unit 12 to compare the actual switching position of the output 
switch 14 with the intended desired position. Consequently, 
this makes it possible to monitor the switching position of the 
output switch 14. 

[0058] The circuit of the safety switching device 50, as illus- 
trated in Fig. 3, has proved to be particularly effective in 
practical tests. It goes without saying, however, that the 
basic principle of the invention may also have other circuit 
variants . 



WHAT IS CLAIMED IS: 



